Registration process in a wireless communication network

Abstract

Various aspects of the present disclosure relate to a user equipment, UE, for wireless communication, comprising: at least one memory; and at least one processor coupled with the at least one memory and configured to cause the UE to: derive first authentication and key management for applications, AKMA, anchor key after a first authentication process, wherein the first authentication process is performed during a first registration between the UE and a wireless communication network via a first access network; and send, to a non-3GPP interworking function, N3IWF via a second access network, a first request message for initiating a second registration with the wireless communication network, the first request message comprising a first authentication payload, wherein the first authentication payload is generated based on a first N3IWF key, wherein the first N3IWF key is derived by the UE based on the first AKMA anchor key and an identifier for the N3IWF.

Description

REGISTRATION PROCESS IN A WIRELESS COMMUNICATIONNETWORKTECHNICAL FIELD

[0001] The subject matter disclosed herein relates generally to the field of implementing a registration process in a wireless communication network. In particular, this document defines an apparatus, a processor and a method for each of a user equipment (UE), a Non-3GPP Interworking Function (N3IWF) and an Authentication and Key Management for Applications (AKMA) Anchor Function (AAnF).BACKGROUND

[0002] A wireless communications system may include one or multiple network communication devices, such as base stations, which may support wireless communications for one or multiple user communication devices, which may be otherwise known as user equipment (UE), or other suitable terminology. The wireless communications system may support wireless communications with one or multiple user communication devices by utilizing resources of the wireless communication system (e.g., time resources (e.g., symbols, slots, subframes, frames, or the like) or frequency resources (e.g., subcarriers, carriers, or the like). Additionally, the wireless communications system may support wireless communications across various radio access technologies including third generation (3G) radio access technology, fourth generation (4G) radio access technology, fifth generation (5G) radio access technology, among other suitable radio access technologies beyond 5G (e.g., sixth generation (6G)).SUMMARY

[0003] An article “a” before an element is unrestricted and understood to refer to “at least one” of those elements or “one or more” of those elements. The terms “a,” “at least one,” “one or more,” and “at least one of one or more” may be interchangeable. As used herein, including in the claims, “or” as used in a list of items (e.g., a list of items prefaced by a phrase such as “at least one of’ or “one or more of’ or “one or both of’) indicates an inclusive list such that, for example, a list of at least one of A, B, or C means A or B or C orAB or AC or BC or ABC (i.e., A and B and C). Also, as used herein, the phrase “based on” shall not be construed as a reference to a closed set of conditions. For example, an example step that is described as “based on condition A” may be based on both a condition A and a condition B without departing from the scope of the present disclosure. In other words, as used herein, the phrase “based on” shall be construed in the same manner as the phrase “based at least in part on. Further, as used herein, including in the claims, a “set” may include one or more elements.

[0004] There is provided a user equipment, UE, for wireless communication, comprising: at least one memory; and at least one processor coupled with the at least one memory and configured to cause the UE to: derive first authentication and key management for applications, AKMA, anchor key after a first authentication process, wherein the first authentication process is performed during a first registration between the UE and a wireless communication network via a first access network; and send, to a non-3GPP interworking function, N3IWF via a second access network, a first request message for initiating a second registration with the wireless communication network, the first request message comprising a first authentication payload, wherein the first authentication payload is generated based on a first N3IWF key, wherein the first N3IWF key is derived by the UE based on the first AKMA anchor key and an identifier for the N3IWF.

[0005] There is further provided a processor for wireless communication, comprising: at least one controller coupled with at least one memory and configured to cause the processor to: derive first authentication and key management for applications, AKMA, anchor key after a first authentication process, wherein the first authentication process is performed during a first registration between a user equipment, UE, and a wireless communication network via a first access network; and send, to a non-3GPP interworking function, N3IWF via a second access network, a first request message for initiating a second registration with the wireless communication network, the first request message comprising a first authentication payload, wherein the first authentication payload is generated based on a first N3IWF key, wherein the first N3IWF key is derived by the UE based on the first AKMA anchor key and an identifier for the N3IWF.

[0006] There is further provided a method performed by a user equipment, UE, the method comprising: deriving a first authentication and key management for applications, AKMA, anchor key after a first authentication process, wherein the first authentication process is performed during a first registration between the UE and a wireless communication network via a first access network; and sending, to a non-3GPP interworking function, N3IWF via a second access network, a first request message for initiating a second registration with the wireless communication network, the first request message comprising a first authentication payload, wherein the first authentication payload is generated based on a first N3IWF key, wherein the first N3IWF key is derived by the UE based on the first AKMA anchor key and an identifier for the N3IWF.

[0007] There is further provided a non-3GPP interworking function, N3IWF, for wireless communication, comprising: at least one memory; and at least one processor coupled with the at least one memory and configured to cause the N3IWF to: receive, from a user equipment, UE, via a second access network, a first request message for initiating a second registration with a wireless communication network, the first request message comprising a first authentication payload, wherein the first authentication payload is generated based on a first N3IWF key, wherein the first N3IWF key is derived by the UE based on a first authentication and key management for applications, AKMA, anchor key and an identifier for the N3IWF, wherein the first AKMA anchor key is derived by the UE after a first authentication process, wherein the first authentication process is performed during a first registration between the UE and a wireless communication network via a first access network.

[0008] There is further provided a processor for wireless communication, comprising: at least one controller coupled with at least one memory and configured to cause the processor to: receive, from a user equipment, UE, via a second access network, a first request message for initiating a second registration with a wireless communication network, the first request message comprising a first authentication payload, wherein the first authentication payload is generated based on a first N3IWF key, wherein the first N3IWF key is derived by the UE based on a first authentication and key management for applications, AKMA, anchor key and an identifier for the N3IWF, wherein the first AKMAanchor key is derived by the UE after a first authentication process, wherein the first authentication process is performed during a first registration between the UE and a wireless communication network via a first access network.

[0009] There is further provided a method performed by a non-3GPP interworking function, N3IWF, the method comprising: receiving, from a user equipment, UE, via a second access network, a first request message for initiating a second registration with a wireless communication network, the first request message comprising a first authentication payload, wherein the first authentication payload is generated based on a first N3IWF key, wherein the first N3IWF key is derived by the UE based on a first authentication and key management for applications, AKMA, anchor key and an identifier for the N3IWF, wherein the first AKMA anchor key is derived by the UE after a first authentication process, wherein the first authentication process is performed during a first registration between the UE and a wireless communication network via a first access network.

[0010] There is further provided an Authentication and Key Management for Applications, AKMA, Anchor Function, AAnF, for wireless communication, comprising: at least one memory; and at least one processor coupled with the at least one memory and configured to cause the AAnF to: receive, from a non-3GPP interworking function, N3IWF, a third request message indicating a request for a second N3IWF key, wherein the third request message comprises an identifier for the N3IWF, wherein the second N3IWF key is derived by a wireless communication network based on a second AKMA anchor key, wherein the second AKMA anchor key is derived by the wireless communication network after a first authentication process, wherein the first authentication process is performed during a first registration between a user equipment, UE, and the wireless communication network; and send, to the N3IWF, a third response message comprising an indication of the second N3IWF key.

[0011] There is further provided a processor for wireless communication, comprising: at least one controller coupled with at least one memory and configured to cause the processor to: receive, from a non-3GPP interworking function, N3IWF, a third request message indicating a request for a second N3IWF key, wherein the third request messagecomprises an identifier for the N3IWF, wherein the second N3IWF key is derived by a wireless communication network based on a second AKMA anchor key, wherein the second AKMA anchor key is derived by the wireless communication network after a first authentication process, wherein the first authentication process is performed during a first registration between a user equipment, UE, and the wireless communication network; and send, to the N3IWF, a third response message comprising an indication of the second N3IWF key.

[0012] There is provided a method performed by an Authentication and Key Management for Applications, AKMA, Anchor Function, AAnF, the method comprising: receiving, from a non-3GPP interworking function, N3IWF, a third request message indicating a request for a second N3IWF key, wherein the third request message comprises an identifier for the N3IWF, wherein the second N3IWF key is derived by a wireless communication network based on a second AKMA anchor key, wherein the second AKMA anchor key is derived by the wireless communication network after a first authentication process, wherein the first authentication process is performed during a first registration between a user equipment, UE, and the wireless communication network; and sending, to the N3IWF, a third response message comprising an indication of the second N3IWF key.BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 illustrates an example of a wireless communications system in accordance with aspects of the present disclosure.

[0014] Figures 2a and 2b illustrate a registration process in accordance with aspects of the present disclosure.

[0015] Figure 3 illustrates a key generation process in accordance with aspects of the present disclosure.

[0016] Figures 4a and 4b illustrate a registration process in accordance with aspects of the present disclosure.

[0017] Figures 5a and 5b illustrate a registration process in accordance with aspects of the present disclosure.

[0018] Figure 6 illustrates an example of a user equipment (UE) 600 in accordance with aspects of the present disclosure.

[0019] Figure 7 illustrates an example of a processor 700 in accordance with aspects of the present disclosure.

[0020] Figure 8 illustrates an example of a network equipment (NE) 800 in accordance with aspects of the present disclosure.

[0021] Figure 9 illustrates a flowchart of a method 900 performed by a UE in accordance with aspects of the present disclosure.

[0022] Figure 10 illustrates a flowchart of a method 1000 performed by a NE in accordance with aspects of the present disclosure.

[0023] Figure 11 illustrates a flowchart of a method 1100 performed by a NE in accordance with aspects of the present disclosure.DETAILED DESCRIPTION

[0024] User Equipment (UE) registration with wireless communication networks or mobile communication networks through untrusted non-3GPP access networks is currently specified via a procedure that employs Internet Key Exchange version 2 (IKEv2) and Internet Protocol security (IPsec) protocols., as detailed in 3GPP TS 23.502 V18.5.0, section 4.12.2.2. For example, the mobile communication network may be a fifth generation (5G) network and the non-3GPP access network may be a Wireless Fidelity (WiFi) network. The procedure described in TS 23.502 suggests both the UE and the Non- 3GPP Interworking Function (N3IWF) establish an Extensible Authentication Protocol (EAP) session and transfer Non Access Stratum (NAS) signaling messages through this session. This dependency on the EAP session complicates the registration process and extends the time required for successful network connection.

[0025] There is presented herein communication technology and procedures for registration of user equipment (UE) with a 5G network via untrusted non-3GPP access networks. Such communication technology and procedures tend to reduce the signalingoverhead in the existing procedure described above and improve connectivity between the UE and mobile communication networks via untrusted non-3GPP access.

[0026] Aspects of the present disclosure are described in the context of a wireless communications system.

[0027] Figure 1 illustrates an example of a wireless communications system 100 in accordance with aspects of the present disclosure. The wireless communications system 100 may include one or more NE 102, one or more UE 104, and a core network (CN) 106. The wireless communications system 100 may support various radio access technologies. In some implementations, the wireless communications system 100 may be a 4G network, such as an LTE network or an LTE- Advanced (LTE-A) network. In some other implementations, the wireless communications system 100 may be a NR network, such as a 5G network, a 5G-Advanced (5G-A) network, or a 5G ultrawideband (5G-UWB) network. In other implementations, the wireless communications system 100 may be a combination of a 4G network and a 5G network, or other suitable radio access technology including Institute of Electrical and Electronics Engineers (IEEE) 802.11 (Wi-Fi), IEEE 802.16 (WiMAX), IEEE 802.20. The wireless communications system 100 may support radio access technologies beyond 5G, for example, 6G. Additionally, the wireless communications system 100 may support technologies, such as time division multiple access (TDMA), frequency division multiple access (FDMA), or code division multiple access (CDMA), etc.

[0028] The one or more NE 102 may be dispersed throughout a geographic region to form the wireless communications system 100. One or more of the NE 102 described herein may be or include or may be referred to as a network node, a base station, a network element, a network function, a network entity, a radio access network (RAN), a NodeB, an eNodeB (eNB), a next-generation NodeB (gNB), or other suitable terminology. An NE 102 and a UE 104 may communicate via a communication link, which may be a wireless or wired connection. For example, an NE 102 and a UE 104 may perform wireless communication (e.g., receive signalling, transmit signalling) over a Uu interface.

[0029] An NE 102 may provide a geographic coverage area for which the NE 102 may support services for one or more UEs 104 within the geographic coverage area. Forexample, an NE 102 and a UE 104 may support wireless communication of signals related to services (e.g., voice, video, packet data, messaging, broadcast, etc.) according to one or multiple radio access technologies. In some implementations, an NE 102 may be moveable, for example, a satellite associated with a non-terrestrial network (NTN). In some implementations, different geographic coverage areas associated with the same or different radio access technologies may overlap, but the different geographic coverage areas may be associated with different NE 102.

[0030] The one or more UE 104 may be dispersed throughout a geographic region of the wireless communications system 100. A UE 104 may include or may be referred to as a remote unit, a mobile device, a wireless device, a remote device, a subscriber device, a transmitter device, a receiver device, or some other suitable terminology. In some implementations, the UE 104 may be referred to as a unit, a station, a terminal, or a client, among other examples. Additionally, or alternatively, the UE 104 may be referred to as an Internet-of-Things (loT) device, an Internet-of-Everything (loE) device, or machine-type communication (MTC) device, among other examples.

[0031] A UE 104 may be able to support wireless communication directly with other UEs 104 over a communication link. For example, a UE 104 may support wireless communication directly with another UE 104 over a device-to-device (D2D) communication link. In some implementations, such as vehi cl e-to- vehicle (V2V) deployments, vehicle-to-everything (V2X) deployments, or cellular-V2X deployments, the communication link may be referred to as a sidelink. For example, a UE 104 may support wireless communication directly with another UE 104 over a PC5 interface.

[0032] An NE 102 may support communications with the CN 106, or with another NE 102, or both. For example, an NE 102 may interface with other NE 102 or the CN 106 through one or more backhaul links (e.g., SI, N2, N2, or network interface). In some implementations, the NE 102 may communicate with each other directly. In some other implementations, the NE 102 may communicate with each other or indirectly (e.g., via the CN 106. In some implementations, one or more NE 102 may include subcomponents, such as an access network entity, which may be an example of an access node controller (ANC). An ANC may communicate with the one or more UEs 104 through one or more otheraccess network transmission entities, which may be referred to as a radio heads, smart radio heads, or transmission-reception points (TRPs).

[0033] The CN 106 may support user authentication, access authorization, tracking, connectivity, and other access, routing, or mobility functions. The CN 106 may be an evolved packet core (EPC), or a 5G core (5GC), which may include a control plane entity that manages access and mobility (e.g., a mobility management entity (MME), an access and mobility management functions (AMF)) and a user plane entity that routes packets or interconnects to external networks (e.g., a serving gateway (S-GW), a Packet Data Network (PDN) gateway (P-GW), or a user plane function (UPF)). In some implementations, the control plane entity may manage non-access stratum (NAS) functions, such as mobility, authentication, and bearer management (e.g., data bearers, signal bearers, etc.) for the one or more UEs 104 served by the one or more NE 102 associated with the CN 106.

[0034] The CN 106 may communicate with a packet data network over one or more backhaul links (e.g., via an SI, N2, N2, or another network interface). The packet data network may include an application server. In some implementations, one or more UEs 104 may communicate with the application server. A UE 104 may establish a session (e.g., a protocol data unit (PDU) session, or the like) with the CN 106 via an NE 102. The CN 106 may route traffic (e.g., control information, data, and the like) between the UE 104 and the application server using the established session (e.g., the established PDU session). The PDU session may be an example of a logical connection between the UE 104 and the CN 106 (e.g., one or more network functions of the CN 106).

[0035] In the wireless communications system 100, the NEs 102 and the UEs 104 may use resources of the wireless communications system 100 (e.g., time resources (e.g., symbols, slots, subframes, frames, or the like) or frequency resources (e.g., subcarriers, carriers)) to perform various operations (e.g., wireless communications). In some implementations, the NEs 102 and the UEs 104 may support different resource structures. For example, the NEs 102 and the UEs 104 may support different frame structures. In some implementations, such as in 4G, the NEs 102 and the UEs 104 may support a single frame structure. In some other implementations, such as in 5G and among other suitable radio access technologies, the NEs 102 and the UEs 104 may support various frame structures(i.e., multiple frame structures). The NEs 102 and the UEs 104 may support various frame structures based on one or more numerologies.

[0036] One or more numerologies may be supported in the wireless communications system 100, and a numerology may include a subcarrier spacing and a cyclic prefix. A first numerology (e.g., / t=0) may be associated with a first subcarrier spacing (e.g., 15 kHz) and a normal cyclic prefix. In some implementations, the first numerology (e.g., / t=0) associated with the first subcarrier spacing (e.g., 15 kHz) may utilize one slot per subframe. A second numerology (e.g., / / =1) may be associated with a second subcarrier spacing (e.g., 30 kHz) and a normal cyclic prefix. A third numerology (e.g., g=2) may be associated with a third subcarrier spacing (e.g., 60 kHz) and a normal cyclic prefix or an extended cyclic prefix. A fourth numerology (e.g., / t=3) may be associated with a fourth subcarrier spacing (e.g., 120 kHz) and a normal cyclic prefix. A fifth numerology (e.g., / t=4) may be associated with a fifth subcarrier spacing (e.g., 240 kHz) and a normal cyclic prefix.

[0037] A time interval of a resource (e.g., a communication resource) may be organized according to frames (also referred to as radio frames). Each frame may have a duration, for example, a 10 millisecond (ms) duration. In some implementations, each frame may include multiple subframes. For example, each frame may include 10 subframes, and each subframe may have a duration, for example, a 1 ms duration. In some implementations, each frame may have the same duration. In some implementations, each subframe of a frame may have the same duration.

[0038] Additionally or alternatively, a time interval of a resource (e.g., a communication resource) may be organized according to slots. For example, a subframe may include a number (e.g., quantity) of slots. The number of slots in each subframe may also depend on the one or more numerologies supported in the wireless communications system 100. For instance, the first, second, third, fourth, and fifth numerologies (i.e., / t=0, / t=l, =2, jtz=3, =4) associated with respective subcarrier spacings of 15 kHz, 30 kHz, 60 kHz, 120 kHz, and 240 kHz may utilize a single slot per subframe, two slots per subframe, four slots per subframe, eight slots per subframe, and 16 slots per subframe, respectively. Each slot may include a number (e.g., quantity) of symbols (e.g., OFDM symbols). In some implementations, the number (e.g., quantity) of slots for a subframe may depend on anumerology. For a normal cyclic prefix, a slot may include 14 symbols. For an extended cyclic prefix (e.g., applicable for 60 kHz subcarrier spacing), a slot may include 12 symbols. The relationship between the number of symbols per slot, the number of slots per subframe, and the number of slots per frame for a normal cyclic prefix and an extended cyclic prefix may depend on a numerology. It should be understood that reference to a first numerology (e.g., / t=0) associated with a first subcarrier spacing (e.g., 15 kHz) may be used interchangeably between subframes and slots.

[0039] In the wireless communications system 100, an electromagnetic (EM) spectrum may be split, based on frequency or wavelength, into various classes, frequency bands, frequency channels, etc. By way of example, the wireless communications system 100 may support one or multiple operating frequency bands, such as frequency range designations FR1 (410 MHz - 7.125 GHz), FR2 (24.25 GHz - 52.6 GHz), FR3 (7.125 GHz - 24.25 GHz), FR4 (52.6 GHz - 114.25 GHz), FR4a or FR4-1 (52.6 GHz - 71 GHz), and FR5 (114.25 GHz - 300 GHz). In some implementations, the NEs 102 and the UEs 104 may perform wireless communications over one or more of the operating frequency bands. In some implementations, FR1 may be used by the NEs 102 and the UEs 104, among other equipment or devices for cellular communications traffic (e.g., control information, data). In some implementations, FR2 may be used by the NEs 102 and the UEs 104, among other equipment or devices for short-range, high data rate capabilities.

[0040] FR1 may be associated with one or multiple numerol ogies (e.g., at least three numerologies). For example, FR1 may be associated with a first numerology (e.g., / t=0), which includes 15 kHz subcarrier spacing; a second numerology (e.g., / / =1), which includes 30 kHz subcarrier spacing; and a third numerology (e.g., / / =2), which includes 60 kHz subcarrier spacing. FR2 may be associated with one or multiple numerologies (e.g., at least 2 numerologies). For example, FR2 may be associated with a third numerology (e.g., / z=2), which includes 60 kHz subcarrier spacing; and a fourth numerology (e.g., / t=3), which includes 120 kHz subcarrier spacing.

[0041] Examples described herein generally involve enhancing the existing registration procedures by using Authentication and Key Management for Applications (AKMA) which tends to streamline the registration process and improve its efficiency.

[0042] Figures 2a and 2b illustrate a registration process 200 in accordance with aspects of the present disclosure.

[0043] The registration process 200 involves the registration of a UE 210 with a mobile communication network via an untrusted non-3GPP Access Network 220. The mobile communication network comprises a Non-3GPP Interworking Function (N3IWF) 230, an Access & Mobility Management Function (AMF) 240 and an Authentication Server Function (AUSF) 250.

[0044] The registration process 200 comprises steps 271 to 283. Steps 271 to 276b are shown in Figure 2a. Steps 277 to 283 are shown in Figure 2b.

[0045] In step 271a, the UE 210 connects to the untrusted non-3GPP access network 220 and is allocated an IP address. In step 271b, the UE 210 selects an N3IWF (e.g., N3IWF 230) and obtains an IP address for the N3IWF.

[0046] In step 272, the UE 210 and N3IWF 230 perform an IKE_SA_INIT.

[0047] In step 273, the UE 210 requests IKE AUTH Req (UE Id, without AUTH) to the N3IWF 230.

[0048] In step 274, the N3IWF 230 sends an IKE AUTH Res (EAP-Req / 5G- Start) to the UE 210.

[0049] In step 275, the UE 210 sends an IKE AUTH Req (EAP-Res / 5G-NAS / AN- Params, NAS-PDU [Registration Request]) to the N3IWF 230.

[0050] In step 276a, the N3IWF 230 selects the AMF 240. In step 276b, the N3IWF 230 sends an N2 msg (Registration Request) to the AMF 204.

[0051] In step 277a, the N3IWF 230 and AMF 240 perform an N2 msg (Identity Req. / Res.). In step 277b, the N3IWF 230 and UE 210 perform an IKE AUTH Req / Res (EAP-Req / Res / 5G-NAS / NAS-PDU [Identity Req. / Res.]).

[0052] In step 278a, the AMF 240 sends an AAA Key Request (SUCI or SUPI) to the AUSF 250. In step 278b, the AUSF 250 sends an AAA msg (EAP / AKA-Challenge) to the AMF 240. In step 278c, the AMF 240 sends an N2 msg (Auth. Request [EAP / AKA-Challenge]) to the N3IWF 230. In step 278d, the N3IWF 230 sends an IKE AUTH Res (EAP-Req / 5G-NAS / NAS-PDU [Auth. Request[EAP / AKA-Challenge]]) to the UE 210. In step 278e, the UE 230 sends an IKE AUTH Req (EAP-Res / 5G-NAS / NAS-PDU [Auth. Response[EAP / AKA-Challenge]]) to the N3IWF 230. In step 278f, the N3IWF 230 sends an N2 msg (Auth. Response[EAP / AKA-Challenge]) to the AMF 240. In step 278g, the AMF 240 sends an AAA msg (EAP / AKA-Challenge) to the AUSF 250. In step 278h, the AUSF 250 sends an AAA Key Response (SEAF key, EAP-Success) to the AMF 240.

[0053] In step 279a, the AMF 240 sends an N2 msg (Security Mode Command[EAP- Success]) to the N3IWF 230. In step 279b, the N3IWF 230 sends an IKE AUTH Res (EAP-Req / 5G-NAS / NAS-PDU [NAS Security Mode Command[EAP-Success]]) to the UE 210. In step 279c, the UE 210 sends an IKE AUTH Req (EAP-Res / 5G-NAS / NAS-PDU [Security Mode Complete]) to the N3IWF 230. In step 279d, the N3IWF 230 sends an N2 msg ([NAS Security Mode Complete]) to the AMF 240.

[0054] In step 280a, the AMF 240 sends an Initial Context Setup Req (N3IWF key) to the N3IWF 230. In step 280b, the N3IWF 230 sends an IKE AUTH Res (EAP-Success) to the UE 210.

[0055] In step 281a, the UE 210 and N3IWF 230 perform an IKE AUTH (with AUTH) and the IPSec SA is established. In step 281b, the N3IWF 230 sends an Initial Context Setup Res to the AMF 240.

[0056] In step 282, the AMF 240 sends an N2 msg (NAS Registration Accept) to the N3IWF 230.

[0057] In step 283, the N3IWF 230 sends a [NAS over IPsec] NAS Registration Accept to the UE 210 and all subsequent NAS messages are carried over the IPsec SA.

[0058] The registration process 200 may be an example of the UE 210 registration with 5G networks through the untrusted non-3GPP access network 220. The untrusted non- 3GPP Access Network 220 may be a Wi-Fi network. The registration process 200 may correspond to a process used in the past; such as a process employing IKEv2 and IPsec protocols, as detailed in 3GPP TS 23.502 V18.5.0, section 4.12.2.2. In the registration process 200, the UE 210 and N3IWF 230 establish an Extensible Authentication Protocol(EAP) session and transfer NAS signaling messages through this session. In registration process 200, the EAP session starts in step 274 and is completed in step 280b. This dependency on the EAP session complicates the registration process and extends the time required for successful network connection.

[0059] Examples described herein relate to an optimized registration procedure that leverages the Authentication and Key Management for Applications (AKMA) mechanism, as specified in TS 33.535 V18.3.0. By applying AKMA, mutual authentication between the UE and the 5G network may be achieved directly, without the need for an EAP session. This advancement tends to simplify the registration process, enhance efficiency, and expedite the 5G registration procedure via untrusted non-3GPP access network. The proposed method addresses inefficiencies in the existing procedure and makes connectivity to 5G network via untrusted non-3GPP accesses (such as residential or enterprise WiFi networks), easier to develop.

[0060] Figure 3 illustrates a key generation process 300 in accordance with aspects of the present disclosure.

[0061] The key generation process 300 is performed between a UE 310, an AUSF 350, an AAnF 355, an Application Function (AF) 360 and a Unified Data Management (UDM) 365. The key generation process 300 may be an AF Key (KAF) generation from an AKMA Key (KAKMA) from TS 33.535 V18.3.0.

[0062] The key generation process 300 begins with a (pre-requisite) primary authentication and establishment of KAKMA between the UE 310 and AAnF 355.

[0063] In step 371, the UE 310 sends an Application Session Establishment Request (A-KID) to the AF 360.

[0064] In step 372, the AF 360 sends a Naanf AKMA ApplicationKey Get Request (A-KID, AF ID) to the AAnF 355.

[0065] In step 373, the AAnF 355 sends a Nudm SDM Get Request (Identifier Translation, SUPI) to the UDM 365.

[0066] In step 374, the UDM 365 sends a Nudm SDM Get Response (GPSI) to the AAnF 355.

[0067] In step 375, the AAnF 355 sends a Nudm EventExposure Subscribe Request (SUPI / GPSI) to the UDM 365.

[0068] In step 376, the UDM 365 sends a Nudm EventExposure Subscribe Response(roaming, newServingPlmn, accessType) to the AAnF 355.

[0069] In step 377, the AAnF 355 derives the AF key from the AKMA key.

[0070] In step 378, the AAnF 355 sends a Naanf_AKMA_ApplicationKey_GetResponse (KAF, KAF expTime, SUPI / GPSI) to the AF 360.

[0071] In step 379, the AF 360 sends an Application Session Establishment Response to the UE 310.

[0072] Examples described herein generally relate to optimizations of the "5G registration via untrusted non-3GPP access" procedure (defined in TS 23.502 V18.5.0, clause 4.12.2.2; as shown in Figure 3. For example, by expediting this procedure by leveraging security material that has been generated in the UE and in the 5G network from a prior primary authentication procedure, e.g., from a prior registration via 3GPP access.

[0073] In some examples described herein, the Authentication and Key Management for Applications (AKMA) is used to avoid the EAP signaling exchange between the UE and N3IWF. This tends to result in faster establishment of a signaling Internet Protocol security (IPsec) Security Association (SA) between a UE and an N3IWF without the need to exchange any EAP signaling. Thus, the 5G registration procedure tends to be simpler and faster.

[0074] In some examples, both the UE and the N3IWF may support AKMA, as defined in TS 33.535 V18.3.0. The N3IWF may operate as an AKMA application function (AF).

[0075] Figures 4a and 4b illustrate a registration process 400 in accordance with aspects of the present disclosure. The registration process 400 may be a 5G registration via Untrusted Non-3GPP Access using AKMA and IKEv2 / IPsec. The registration process 400comprises steps 470 to 484. Steps 470a to 479 are shown in Figure 4a. Steps 480 to 484b are shown in Figure 4b.

[0076] The registration process 400 is performed between a UE 410, an Untrusted non- 3 GPP Access Network 420 and a mobile communication network. The mobile communication network comprises a 3GPP Access Network 425, an N3IWF 430, an AMF 440, an AUSF 450 and an AAnF 455. The mobile communication network may be a 5G network. The UE 410 may support AKMA. The N3IWF 430 may support AKMA. Steps 472 to 479 correspond to an establishment of a NWu connection which is indicated by a dashed line box 490 in Figure 4a.

[0077] In step 470a, a pre-requisite, primary authentication is executed between the UE 410 and the AUSF 450 in the 5G network. This may occur when the UE 410 registers with the 5G network via a 3GPP Access Network 425. The 3GPP Access Network 425 may be a Next Generation (NG)-Radio Access Network (RAN).

[0078] In step 470b, both the UE 410 and AUSF 450 compute independently an AUSF key (KAUSF). After the primary authentication procedure is successfully completed, the AUSF 450 applies KAUSF to generate an AKMA Anchor Key (KAKMA) and an AKMA Key Identifier (A-KID). The UE 410 generates the AKMA Anchor Key (KAKMA) and the A-KID from the KAUSF after the primary authentication. Alternatively, the UE 410 may generate the KAKMA and A-KID later but before initiating communication with N3IWF 430.

[0079] In step 470c, the AUSF 450 selects AAnF 455 as an AAnF. The selection procedure may be as defined in TS 33.535 V18.3.0 clause 6.7. The AUSF 450 sends the generated A-KID and KAKMA to the selected AAnF 455 together with the Subscription Permanent Identifier (SUPI) of the UE 410. This may be done using the Naanf AKMA KeyRegi strati on Request service operation. The AAnF 455 stores the information provided by the AUSF 450.

[0080] In step 471, the UE 410 connects to an untrusted non-3GPP access network 420. The untrusted non-3GPP access network may be at least one of: a home WiFi network, an enterprise WiFi network, or a public hotspot. In step the, the UE 410 applies the existing Domain Name System (DNS) procedures to discover the IP address of an N3IWF 430 inthe 5G network with which the UE 410 performed the primary authentication in step 470a. The UE 410 selects an N3IWF that supports AKMA. These DNS procedures may be extended to support discovery of N3IWFs that support AKMA. For example, the UE 410 may use a Fully Qualified Domain Name (FQDN) when making the DNS request. The FQDN may indicate that discovery of N3IWFs supporting AKMA is needed. The FQDN m“y be "n3iwf.akma.5gc.mnc<MNC>.mcc<MCC>.pub.3gppnetwo”k.org" which is different from the Operator Identifier based N3IWF FQDN defined in TS 23.003 V18.5.0, clause 28.3.2.2.2. The DNS response message received by the UE may contain a unique identity for the discovered N3IWF (N3IWF_ID).

[0081] In step 472, the UE 410 initiates an IKE initial exchange with the discovered N3IWF 430, and an IKE Security Association (IKE SA) is established between the UE 410 and N3IWF 430, according to RFC 7296. After this step, all subsequent IKE messages may be encrypted, and integrity protected by using the IKE SA established in this step.

[0082] In step 473, the UE 410 derives an N3IWF key (KNSIWF) from the generated AKMA anchor key and an N3IWF identity (the N3IWF identity may be referred to as an identifier for the N3IWF). The N3IWF identity may be an FQDN. The N3IWF key (KNSIWF) may be an AF key (KAF) and may be derived based on a derivation function defined in TS 33.353 V18.3.0, clause A.4, "KAF derivation function".

[0083] In addition, the UE 410 generates an authentication payload (denoted as AUTH- 1) that will be used in the next step. The structure of the authentication payload may be as defined in RFC 7296. In this case, the AUTH-1 payload contains (a) an "Auth Method" field indicating that Pre-Shared Key (PSK) authentication is requested, and (b) an "Auth Data" field containing a cryptographic hash computed using the N3IWF key in the UE 410.

[0084] In step 474, the UE 410 initiates an IKE AUTH exchange by sending an IKE AUTH request message. In contrast with TS 23.502 V18.5.0, which indicates that this message does not include an AUTH payload and EAP authentication is triggered, the UE 410 includes in this message the AUTH-1 calculated in step 473 and the generated A-KID. The AUTH-1 provides evidence that the UE 410 has generated the correct N3IWF key.

[0085] In step 475, the N3IWF 430 selects an AKMA Anchor Function (AAnF) 455 based on the received A-KID, which may be as defined in TS 33.353 V18.3.0, clause 6.7, "AAnF Discovery and Selection". The N3IWF 430 selects the same AAnF 455 as the one selected by AUSF 450 in step 470. Although the AAnF selection may be based on existing procedures, it is a new step for N3IWF 430.

[0086] In step 476a, The N3IWF 430 sends an Naanf_AKMA_ApplicationKey_Get Request (A-KID, N3IWF ID) message to the selected AanF 455, which may be as defined in TS 33.353 V18.3.0. In step 476b, the AAnF 455 derives the N3IWF key (KNSIWF) based on the received N3IWF ID and the stored KAKMA that is referenced by the received A-KID. The method used by AAnF 455 to derive the N3IWF key is the same with the method used by the UE 410 to derive the N3IWF key, hence, the N3IWF keys in the UE 410 and in the AAnF 455 are the same. In step 476c, the AAnF 455 sends to N3IWF 430 the derived N3IWF key and an expiration time for this key within anNaanf AKMA ApplicationKey Get Response message, which may be as specified in TS 33.535. The Naanf AKMA ApplicationKey Get Response message may also include the SUPI of the UE 410, which was provided by AUSF 450 in step 470. The N3IWF 430 may provide this SUPI to AMF 440 in step 481b as an indication that the UE 410 is already authenticated successfully.

[0087] In step 477, the N3IWF 430 uses the received N3IWF key to validate the AUTH-1 provided by the UE 410 in step 474. This validation may be successfully if the UE 410 has derived the "Auth Data" field in AUTH-1 using the same N3IWF key, as the one received by AAnF 455. In addition, the N3IWF 430 generates an authentication payload (denoted as AUTH-2) that will be used in the next step. The structure of the authentication payload may be as defined in RFC 7296 and contains an "Auth Method" field and an "Auth Data" field containing a cryptographic hash computed using the N3IWF key in the N3IWF 430.

[0088] In step 478a, the N3IWF 430 responds to UE 410 with an IKE AUTH response message, which contains the AUTH-2 calculated in step 477. In step 478b, the UE 410 validates the received AUTH-2. This validation will be successfully if the N3IWF 430 hasderived the "Auth Data" field in AUTH-2 using the same N3IWF key, as the one stored in the UE 410.

[0089] At this point, an IPsec Security Association (SA) between the UE 410 and N3IWF 430 is successfully established. Both the UE 410 and N3IWF 430 have proven that they hold the same N3IWF key. This IPsec SA may be referred to as the "signaling IPsec SA" because it is used to carry NAS signaling messages between the UE 410 and an AMF 440 through the N3IWF 430.

[0090] In step 479, over the established signaling IPsec SA, the UE 410 establishes a Transmission Control Protocol (TCP) connection with the N3IWF 430, which may be as specified in TS 23.502 V18.5.0. This concludes the establishment of the NWu connection between the UE 410 and N3IWF 430.

[0091] In steps 480 to 484, the UE 410 exchanges NAS signaling messages with an AMF 440 in the 5G core network via the N3IWF 430 and over the established NWu connection, which comprises the signaling IPsec SA and the TCP connection. For example, the UE 410 may initiate registration with the 5G network via the N3IWF 430 by sending a NAS Registration Request message over the established NWu connection. The N3IWF 430 receives this NAS message. The NAS Registration Request message is a NAS over NWu connection AN-Params[UE id], NAS-PDU [Registration Request],

[0092] In step 481a, the N3IWF 430 selects AMF 440 and relays the NAS message to the AMF 440 within an N2 message. Optionally, the N3IWF 430 may include in the N2 message an indication that the UE 410 is already authenticated successfully (e.g., "AKMA Auth Successful" indication or SUPI). This provides an additional indication to AMF 440 that the UE 410 can be trusted and may trigger the AMF 440 to skip another primary authentication procedure between the UE 410 and the AUSF 450.

[0093] In step 482a, the AMF 440 sends an N2 msg (Security Mode Command) to N3IWF. In step 482b, the N3IWF 430 sends a NAS over NWu connection NAS-PDU [Security Mode Command] to UE 410. In step 482c, the UE 410 sends a NAS over NWu connection NAS-PDU [Security Mode Complete]) to the N3IWF 430. In step 482d, the N3IWF 430 sends a N2 msg ([NAS Security Mode Complete]) to AMF 440.

[0094] In step 483a, the AMF 440 sends an Initial Context Setup Req to N3IWF 430. In step 483b, the N3IWF 430 sends an Initial Context Setup Res to AMF 440.

[0095] In step 484a, the AMF 440 sends an N2 msg NAS Registration Accept message to N3IWF 430. In step 484b, the N2 msg NAS Registration Accept message is relayed by N3IWF 430 to the UE 410 through the established NWu connection using a NAS over NWu connection NAS-PDU [Security Mode Command],

[0096] Figures 5a and 5b illustrate a registration process 500 in accordance with aspects of the present disclosure. The registration process 500 may be a 5G registration via Untrusted Non-3GPP Access using AKMA and QUIC. The registration process 500 comprises steps 570 to 584. Steps 570a to 578b are shown in Figure 5a. Steps 580 to 584b are shown in Figure 5b.

[0097] The registration process 500 is performed between a UE 510, an Untrusted non- 3 GPP Access Network 520 and a mobile communication network. The mobile communication network comprises a 3GPP Access Network 525, an N3IWF 530, an AMF 540, an AUSF 550 and an AAnF 555. The mobile communication network may be a 5G network. The UE 510 may support AKMA. The N3IWF 530 may support AKMA. Steps 572 to 578b correspond to an establishment of a QUIC connection between UE 510 and N3IWF 530 which is indicated by dashed line box 590 in Figure 5a. The QUIC connection establishment may be based on TS33.353, clause B.1.3 “Shared key-based authentication between UE and AF".

[0098] In step 570a, a pre-requisite, primary authentication is executed between the UE 510 and the AUSF 550 in the 5G network. This may occur when the UE 510 registers with the 5G network via a 3GPP Access Network 525. The 3GPP Access Network 525 may be an NG-RAN.

[0099] In step 570b, both the UE 510 and AUSF 550 compute independently an AUSF key (KAUSF). After the primary authentication procedure is successfully completed, the AUSF 550 applies KAUSF to generate an AKMA Anchor Key (KAKMA) and an A-KID. The UE 510 generates the AKMA Anchor Key (KAKMA) and the A-KID from the KAUSF afterthe primary authentication. Alternatively, the UE 510 may generate the KAKMA and A-KID later but before initiating communication with N3IWF 530.

[0100] In step 570c, the AUSF 550 selects AAnF 555 as an AAnF. The AAnF 555 may be as defined in TS 33.535 V18.3.0 clause 6.7. The AUSF 550 sends the generated A-KID and KAKMA to the selected AAnF 555 together with the SUPI of the UE 510. This may be done using the Naanf AKMA KeyRegi strati on Request service operation. The AAnF 555 stores the information provided by the AUSF 550.

[0101] In step 571a, the UE 510 connects to an untrusted non-3GPP access network 520. The untrusted non-3GPP access network may be at least one of: a home WiFi network, an enterprise WiFi network, or a public hotspot. In step 571b, the UE 510 applies the existing DNS procedures to discover the IP address of an N3IWF 530 in the 5G network with which the UE 510 performed the primary authentication in step 570a. The UE 510 selects an N3IWF that supports QUIC. These DNS procedures may be extended to support discovery of N3IWFs that support AKMA. For example, the UE 510 may use a FQDN when making the DNS request. The FQDN may indicate that discovery of N3IWFs supporting AKMA is needed. The FQDN may be "n3iwf.akma.5gc.mnc<MNC>.mcc<MCC>. pub.3gppnetwork.org" which is different from the Operator Identifier based N3IWF FQDN defined in TS 23.003 V18.5.0, clause 28.3.2.2.2. The DNS response message received by the UE 510 may contain a unique identity (or identifier) for the discovered N3IWF (N3IWF ID).

[0102] In step 572, the UE 510 sends a QUIC Initial Packet Transport Layer Security (TLS) ClientHello (SupportPSK-based TLD) to the discovered N3IWF 530. In the ClientHello, the UE 510 indicates it wants to use PSK-based TLS, only if the UE 510 has already executed a primary authentication (step 570) and has derived A-KID and KAKMA.

[0103] In step 573, the N3IWF 530 sends a QUIC Initial packet TLS ServerHello + TLS ServerKey Exchange (PSK-identity = “3GPP-AKMA”) to the UE 510.

[0104] In step 574a, the UE 510 derives an N3IWF key (KNSIWF) from the generated AKMA anchor key and an N3IWF identity (the N3IWF identity may be referred to as an identifier for the N3IWF). The N3IWF identity may be an FQDN. The N3IWF key(KNSIWF) may be an AF key and may be derived based on a derivation function defined in TS 33.353 V18.3.0, clause A.4, "KAF derivation function". In addition, the UE 510 derives a first TLS premaster using the N3IWF Key. The first TLS premaster may be a first authentication payload.

[0105] In step 574b, the UE 510 sends a QUIC Handshake packet TLS ClientKeyExchange (PSK identity = "3GPP-AKMA" and A-KID) to the N3IWF 530.

[0106] In step 575, the N3IWF 530 selects an AAnF 555 based on the received A-KID, which may be as defined in TS 33.353 V18.3.0, clause 6.7, "AAnF Discovery and Selection". The N3IWF 530 selects the same AAnF 555 as the one selected by AUSF 550 in step 570. Although the AAnF selection may be based on existing procedures, it is a new step for N3IWF 530.

[0107] In step 576a, the N3IWF 530 sends an Naanf_AKMA_ApplicationKey_Get Request (A-KID, N3IWF ID) message to the selected AAnF 555, which may be as defined in TS 33.353 V18.3.0. In step 576b, the AAnF 555 derives the N3IWF key (KNSIWF) based on the received N3IWF ID and the stored KAKMA that is referenced by the received A-KID. The method used by AAnF 555 to derive the N3IWF key is the same with the method used by the UE 510 to derive the N3IWF key, hence, the N3IWF keys in the UE 510 and in the AAnF 555 are the same. In step 576c, the AAnF 555 sends to N3IWF 530 the derived N3IWF key and an expiration time for this key within anNaanf AKMA ApplicationKey Get Response message, which may be as specified in TS 33.535. The Naanf AKMA ApplicationKey Get Response message may also include the SUPI of the UE 510, which was provided by AUSF 550 in step 570. The N3IWF 530 may provide this SUPI to AMF 540 in step 581b as an indication that the UE 510 is already authenticated successfully.

[0108] In step 577, the N3IWF 530 uses the received N3IWF key to validate the first TLS premaster received from the UE 510 in step 574b. This validation may be successfully if the UE 510 has derived the first TLS premaster using the same N3IWF key, as the one received by AAnF 555. In addition, the N3IWF 530 generates a second TLS premaster from the received N3IWF Key; which will be used in the next step. The second TLS premaster may be a second authentication payload.

[0109] In step 578a, the N3IWF 530 responds to UE 510 with a QUIC Handshake packet completion of handshake message. In step 578b, the UE 510 validates the second TLS premaster. This validation will be successfully if the N3IWF 530 has derived the second TLS premaster using the same N3IWF key, as the one stored in the UE 510.

[0110] In steps 580 to 584, the UE 510 initiates registration with the 5G network via the N3IWF 530 by sending a QUIC Stream AN-Params[UE id], NAS-PDU [Registration Request] over the established QUIC connection. The N3IWF 530 receives this message.[OHl] In step 581a, the N3IWF 530 selects AMF 540 and relays the registration request to the AMF 540 within an N2 message. Optionally, the N3IWF 530 may include in the N2 message an indication that the UE 510 is already authenticated successfully (e.g., "AKMA Auth Successful" indication or SUPI). This provides an additional indication to AMF 540 that the UE 510 can be trusted and may trigger the AMF 540 to skip another primary authentication procedure between the UE 510 and the AUSF 550. The message is a N2 msg (Registration Request, AKMA Auth Successful).

[0112] In step 582a, the AMF 540 sends an N2 msg (Security Mode Command) to N3IWF 530. In step 582b, the N3IWF 530 sends a QUIC Stream NAS-PDU [Security Mode Command] to UE 510. In step 582c, the UE 510 sends a QUIC Stream NAS-PDU [Security Mode Complete]) to the N3IWF 530. In step 582d, the N3IWF 530 sends a N2 msg ([NAS Security Mode Complete]) to AMF 540.

[0113] In step 583a, the AMF 540 sends an Initial Context Setup Req to N3IWF 530. In step 583b, the N3IWF 530 sends an Initial Context Setup Res to AMF 540.

[0114] In step 584a, the AMF 540 sends an N2 msg NAS Registration Accept message to N3IWF 530. In step 584b, the N2 msg NAS Registration Accept message is relayed by N3IWF 530 to the UE 510 through the QUIC Stream using a NAS-PDU [Security Mode Command],

[0115] Figure 6 illustrates an example of a UE 600 in accordance with aspects of the present disclosure. The UE 600 may include a processor 602, a memory 604, a controller 606, and a transceiver 608. The processor 602, the memory 604, the controller 606, or the transceiver 608, or various combinations thereof or various components thereof may beexamples of means for performing various aspects of the present disclosure as described herein. These components may be coupled (e.g., operatively, communicatively, functionally, electronically, electrically) via one or more interfaces.

[0116] The processor 602, the memory 604, the controller 606, or the transceiver 608, or various combinations or components thereof may be implemented in hardware (e.g., circuitry). The hardware may include a processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), or other programmable logic device, or any combination thereof configured as or otherwise supporting a means for performing the functions described in the present disclosure.

[0117] The processor 602 may include an intelligent hardware device (e.g., a general- purpose processor, a DSP, a CPU, an ASIC, an FPGA, or any combination thereof). In some implementations, the processor 602 may be configured to operate the memory 604. In some other implementations, the memory 604 may be integrated into the processor 602. The processor 602 may be configured to execute computer-readable instructions stored in the memory 604 to cause the UE 600 to perform various functions of the present disclosure.

[0118] The memory 604 may include volatile or non-volatile memory. The memory 604 may store computer-readable, computer-executable code including instructions when executed by the processor 602 cause the UE 600 to perform various functions described herein. The code may be stored in a non-transitory computer-readable medium such the memory 604 or another type of memory. Computer-readable media includes both non- transitory computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another. A non-transitory storage medium may be any available medium that may be accessed by a general-purpose or special-purpose computer.

[0119] In some implementations, the processor 602 and the memory 604 coupled with the processor 602 may be configured to cause the UE 600 to perform one or more of the functions described herein (e.g., executing, by the processor 602, instructions stored in the memory 604). For example, the processor 602 may support wireless communication at the UE 600 in accordance with examples as disclosed herein. The UE 600 may be configured to support a means for deriving a first authentication and key management for applications,AKMA, anchor key after a first authentication process, wherein the first authentication process is performed during a first registration between the UE and a wireless communication network via a first access network; and sending, to a non-3GPP interworking function, N3IWF via a second access network, a first request message for initiating a second registration with the wireless communication network, the first request message comprising a first authentication payload, wherein the first authentication payload is generated based on a first N3IWF key, wherein the first N3IWF key is derived by the UE based on the first AKMA anchor key and an identifier for the N3IWF.

[0120] The controller 606 may manage input and output signals for the UE 600. The controller 606 may also manage peripherals not integrated into the UE 600. In some implementations, the controller 606 may utilize an operating system such as iOS®, ANDROID®, WINDOWS®, or other operating systems. In some implementations, the controller 606 may be implemented as part of the processor 602.

[0121] In some implementations, the UE 600 may include at least one transceiver 608. In some other implementations, the UE 600 may have more than one transceiver 608. The transceiver 608 may represent a wireless transceiver. The transceiver 608 may include one or more receiver chains 610, one or more transmitter chains 612, or a combination thereof.

[0122] A receiver chain 610 may be configured to receive signals (e.g., control information, data, packets) over a wireless medium. For example, the receiver chain 610 may include one or more antennas for receive the signal over the air or wireless medium. The receiver chain 610 may include at least one amplifier (e.g., a low-noise amplifier (LN A)) configured to amplify the received signal. The receiver chain 610 may include at least one demodulator configured to demodulate the receive signal and obtain the transmitted data by reversing the modulation technique applied during transmission of the signal. The receiver chain 610 may include at least one decoder for decoding the processing the demodulated signal to receive the transmitted data.

[0123] A transmitter chain 612 may be configured to generate and transmit signals (e.g., control information, data, packets). The transmitter chain 612 may include at least one modulator for modulating data onto a carrier signal, preparing the signal for transmission over a wireless medium. The at least one modulator may be configured to support one ormore techniques such as amplitude modulation (AM), frequency modulation (FM), or digital modulation schemes like phase-shift keying (PSK) or quadrature amplitude modulation (QAM). The transmitter chain 612 may also include at least one power amplifier configured to amplify the modulated signal to an appropriate power level suitable for transmission over the wireless medium. The transmitter chain 612 may also include one or more antennas for transmitting the amplified signal into the air or wireless medium.

[0124] Figure 7 illustrates an example of a processor 700 in accordance with aspects of the present disclosure. The processor 700 may be an example of a processor configured to perform various operations in accordance with examples as described herein. The processor 700 may include a controller 702 configured to perform various operations in accordance with examples as described herein. The processor 700 may optionally include at least one memory 704, which may be, for example, an L1 / L2 / L3 cache. Additionally, or alternatively, the processor 700 may optionally include one or more arithmetic-logic units (ALUs) 706. One or more of these components may be in electronic communication or otherwise coupled (e.g., operatively, communicatively, functionally, electronically, electrically) via one or more interfaces (e.g., buses).

[0125] The processor 700 may be a processor chipset and include a protocol stack (e.g., a software stack) executed by the processor chipset to perform various operations (e.g., receiving, obtaining, retrieving, transmitting, outputting, forwarding, storing, determining, identifying, accessing, writing, reading) in accordance with examples as described herein. The processor chipset may include one or more cores, one or more caches (e.g., memory local to or included in the processor chipset (e.g., the processor 700) or other memory (e.g., random access memory (RAM), read-only memory (ROM), dynamic RAM (DRAM), synchronous dynamic RAM (SDRAM), static RAM (SRAM), ferroelectric RAM (FeRAM), magnetic RAM (MRAM), resistive RAM (RRAM), flash memory, phase change memory (PCM), and others).

[0126] The controller 702 may be configured to manage and coordinate various operations (e.g., signalling, receiving, obtaining, retrieving, transmitting, outputting, forwarding, storing, determining, identifying, accessing, writing, reading) of the processor 700 to cause the processor 700 to support various operations in accordance with examplesas described herein. For example, the controller 702 may operate as a control unit of the processor 700, generating control signals that manage the operation of various components of the processor 700. These control signals include enabling or disabling functional units, selecting data paths, initiating memory access, and coordinating timing of operations.

[0127] The controller 702 may be configured to fetch (e.g., obtain, retrieve, receive) instructions from the memory 704 and determine subsequent instruction(s) to be executed to cause the processor 700 to support various operations in accordance with examples as described herein. The controller 702 may be configured to track memory address of instructions associated with the memory 704. The controller 702 may be configured to decode instructions to determine the operation to be performed and the operands involved. For example, the controller 702 may be configured to interpret the instruction and determine control signals to be output to other components of the processor 700 to cause the processor 700 to support various operations in accordance with examples as described herein. Additionally, or alternatively, the controller 702 may be configured to manage flow of data within the processor 700. The controller 702 may be configured to control transfer of data between registers, arithmetic logic units (ALUs), and other functional units of the processor 700.

[0128] The memory 704 may include one or more caches (e.g., memory local to or included in the processor 700 or other memory, such RAM, ROM, DRAM, SDRAM, SRAM, MRAM, flash memory, etc. In some implementations, the memory 704 may reside within or on a processor chipset (e.g., local to the processor 700). In some other implementations, the memory 704 may reside external to the processor chipset (e.g., remote to the processor 700).

[0129] The memory 704 may store computer-readable, computer-executable code including instructions that, when executed by the processor 700, cause the processor 700 to perform various functions described herein. The code may be stored in a non-transitory computer-readable medium such as system memory or another type of memory. The controller 702 and / or the processor 700 may be configured to execute computer-readable instructions stored in the memory 704 to cause the processor 700 to perform various functions. For example, the processor 700 and / or the controller 702 may be coupled with orto the memory 704, the processor 700, the controller 702, and the memory 704 may be configured to perform various functions described herein. In some examples, the processor 700 may include multiple processors and the memory 704 may include multiple memories. One or more of the multiple processors may be coupled with one or more of the multiple memories, which may, individually or collectively, be configured to perform various functions herein.

[0130] The one or more ALUs 706 may be configured to support various operations in accordance with examples as described herein. In some implementations, the one or more ALUs 706 may reside within or on a processor chipset (e.g., the processor 700). In some other implementations, the one or more ALUs 706 may reside external to the processor chipset (e.g., the processor 700). One or more ALUs 706 may perform one or more computations such as addition, subtraction, multiplication, and division on data. For example, one or more ALUs 706 may receive input operands and an operation code, which determines an operation to be executed. One or more ALUs 706 be configured with a variety of logical and arithmetic circuits, including adders, subtractors, shifters, and logic gates, to process and manipulate the data according to the operation. Additionally, or alternatively, the one or more ALUs 706 may support logical operations such as AND, OR, exclusive-OR (XOR), not-OR (NOR), and not- AND (NAND), enabling the one or more ALUs 706 to handle conditional operations, comparisons, and bitwise operations.

[0131] The processor 700 may support wireless communication in accordance with examples as disclosed herein. The processor 700 may be configured to or operable to support a means for deriving a first authentication and key management for applications, AKMA, anchor key after a first authentication process, wherein the first authentication process is performed during a first registration between the UE and a wireless communication network via a first access network; and sending, to a non-3GPP interworking function, N3IWF via a second access network, a first request message for initiating a second registration with the wireless communication network, the first request message comprising a first authentication payload, wherein the first authentication payload is generated based on a first N3IWF key, wherein the first N3IWF key is derived by the UE based on the first AKMA anchor key and an identifier for the N3IWF.

[0132] Alternatively, the processor 700 may be configured to or operable to support a means for receiving, from a user equipment, UE, via a second access network, a first request message for initiating a second registration with a wireless communication network, the first request message comprising a first authentication payload, wherein the first authentication payload is generated based on a first N3IWF key, wherein the first N3IWF key is derived by the UE based on a first authentication and key management for applications, AKMA, anchor key and an identifier for the N3IWF, wherein the first AKMA anchor key is derived by the UE after a first authentication process, wherein the first authentication process is performed during a first registration between the UE and a wireless communication network via a first access network.

[0133] Alternatively, the processor 700 may be configured to or operable to support a means for receiving, from a non-3GPP interworking function, N3IWF, a third request message indicating a request for a second N3IWF key, wherein the third request message comprises an identifier for the N3IWF, wherein the second N3IWF key is derived by a wireless communication network based on a second AKMA anchor key, wherein the second AKMA anchor key is derived by the wireless communication network after a first authentication process, wherein the first authentication process is performed during a first registration between a user equipment, UE, and the wireless communication network; and sending, to the N3IWF, a third response message comprising an indication of the second N3IWF key.

[0134] Figure 8 illustrates an example of a NE 800 in accordance with aspects of the present disclosure. The NE 800 may include a processor 802, a memory 804, a controller 806, and a transceiver 808. The processor 802, the memory 804, the controller 806, or the transceiver 808, or various combinations thereof or various components thereof may be examples of means for performing various aspects of the present disclosure as described herein. These components may be coupled (e.g., operatively, communicatively, functionally, electronically, electrically) via one or more interfaces.

[0135] The processor 802, the memory 804, the controller 806, or the transceiver 808, or various combinations or components thereof may be implemented in hardware (e.g., circuitry). The hardware may include a processor, a digital signal processor (DSP), anapplication-specific integrated circuit (ASIC), or other programmable logic device, or any combination thereof configured as or otherwise supporting a means for performing the functions described in the present disclosure.

[0136] The processor 802 may include an intelligent hardware device (e.g., a general- purpose processor, a DSP, a CPU, an ASIC, an FPGA, or any combination thereof). In some implementations, the processor 802 may be configured to operate the memory 804. In some other implementations, the memory 804 may be integrated into the processor 802. The processor 802 may be configured to execute computer-readable instructions stored in the memory 804 to cause the NE 800 to perform various functions of the present disclosure.

[0137] The memory 804 may include volatile or non-volatile memory. The memory 804 may store computer-readable, computer-executable code including instructions when executed by the processor 802 cause the NE 800 to perform various functions described herein. The code may be stored in a non-transitory computer-readable medium such the memory 804 or another type of memory. Computer-readable media includes both non- transitory computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another. A non-transitory storage medium may be any available medium that may be accessed by a general-purpose or special-purpose computer.

[0138] In some implementations, the processor 802 and the memory 804 coupled with the processor 802 may be configured to cause the NE 800 to perform one or more of the functions described herein (e.g., executing, by the processor 802, instructions stored in the memory 804). For example, the processor 802 may support wireless communication at the NE 800 in accordance with examples as disclosed herein. The NE 800 may be configured to support a means for receiving, from a user equipment, UE, via a second access network, a first request message for initiating a second registration with a wireless communication network, the first request message comprising a first authentication payload, wherein the first authentication payload is generated based on a first N3IWF key, wherein the first N3IWF key is derived by the UE based on a first authentication and key management for applications, AKMA, anchor key and an identifier for the N3IWF, wherein the first AKMA anchor key is derived by the UE after a first authentication process, wherein the firstauthentication process is performed during a first registration between the UE and a wireless communication network via a first access network.

[0139] Alternatively, the NE 800 may be configured to support a means for receiving, from a non-3GPP interworking function, N3IWF, a third request message indicating a request for a second N3IWF key, wherein the third request message comprises an identifier for the N3IWF, wherein the second N3IWF key is derived by a wireless communication network based on a second AKMA anchor key, wherein the second AKMA anchor key is derived by the wireless communication network after a first authentication process, wherein the first authentication process is performed during a first registration between a user equipment, UE, and the wireless communication network; and sending, to the N3IWF, a third response message comprising an indication of the second N3IWF key.

[0140] The controller 806 may manage input and output signals for the NE 800. The controller 806 may also manage peripherals not integrated into the NE 800. In some implementations, the controller 806 may utilize an operating system such as iOS®, ANDROID®, WINDOWS®, or other operating systems. In some implementations, the controller 806 may be implemented as part of the processor 802.

[0141] In some implementations, the NE 800 may include at least one transceiver 808. In some other implementations, the NE 800 may have more than one transceiver 808. The transceiver 808 may represent a wireless transceiver. The transceiver 808 may include one or more receiver chains 810, one or more transmitter chains 812, or a combination thereof.

[0142] A receiver chain 810 may be configured to receive signals (e.g., control information, data, packets) over a wireless medium. For example, the receiver chain 810 may include one or more antennas for receive the signal over the air or wireless medium. The receiver chain 810 may include at least one amplifier (e.g., a low-noise amplifier (LN A)) configured to amplify the received signal. The receiver chain 810 may include at least one demodulator configured to demodulate the receive signal and obtain the transmitted data by reversing the modulation technique applied during transmission of the signal. The receiver chain 810 may include at least one decoder for decoding the processing the demodulated signal to receive the transmitted data.

[0143] A transmitter chain 812 may be configured to generate and transmit signals (e.g., control information, data, packets). The transmitter chain 812 may include at least one modulator for modulating data onto a carrier signal, preparing the signal for transmission over a wireless medium. The at least one modulator may be configured to support one or more techniques such as amplitude modulation (AM), frequency modulation (FM), or digital modulation schemes like phase-shift keying (PSK) or quadrature amplitude modulation (QAM). The transmitter chain 812 may also include at least one power amplifier configured to amplify the modulated signal to an appropriate power level suitable for transmission over the wireless medium. The transmitter chain 812 may also include one or more antennas for transmitting the amplified signal into the air or wireless medium.

[0144] Figure 9 illustrates a flowchart of a method 900 in accordance with aspects of the present disclosure. The operations of the method may be implemented by a UE as described herein. In some implementations, the UE may execute a set of instructions to control the function elements of the UE to perform the described functions.

[0145] At 902, the method 900 may include deriving a first authentication and key management for applications, AKMA, anchor key after a first authentication process, wherein the first authentication process is performed during a first registration between the UE and a wireless communication network via a first access network. The operations of 902 may be performed in accordance with examples as described herein. In some implementations, aspects of the operations of 902 may be performed by a UE as described with reference to Figure 6.

[0146] At 904, the method 900 may include sending, to a non-3GPP interworking function, N3IWF via a second access network, a first request message for initiating a second registration with the wireless communication network, the first request message comprising a first authentication payload, wherein the first authentication payload is generated based on a first N3IWF key, wherein the first N3IWF key is derived by the UE based on the first AKMA anchor key and an identifier for the N3IWF. The operations of 904 may be performed in accordance with examples as described herein. In some implementations, aspects of the operations of 904 may be performed by a UE as described with reference to Figure 6.

[0147] It should be noted that the method 900 described herein describes a possible implementation, and that the operations and the steps may be rearranged or otherwise modified and that other implementations are possible.

[0148] Figure 10 illustrates a flowchart of a method 1000 in accordance with aspects of the present disclosure. The operations of the method 1000 may be implemented by a NE as described herein. In some implementations, the NE may execute a set of instructions to control the function elements of the NE to perform the described functions.

[0149] At 1002, the method 1000 may include receiving, from a user equipment, UE, via a second access network, a first request message for initiating a second registration with a wireless communication network, the first request message comprising a first authentication payload, wherein the first authentication payload is generated based on a first N3IWF key, wherein the first N3IWF key is derived by the UE based on a first authentication and key management for applications, AKMA, anchor key and an identifier for the N3IWF, wherein the first AKMA anchor key is derived by the UE after a first authentication process, wherein the first authentication process is performed during a first registration between the UE and a wireless communication network via a first access network. The operations of 1002 may be performed in accordance with examples as described herein. In some implementations, aspects of the operations of 1002 may be performed by a NE as described with reference to Figure 8.

[0150] Figure 11 illustrates a flowchart of a method 1100 in accordance with aspects of the present disclosure. The operations of the method 1100 may be implemented by a NE as described herein. In some implementations, the NE may execute a set of instructions to control the function elements of the NE to perform the described functions.

[0151] At 1102, the method 1100 may include receiving, from a non-3GPP interworking function, N3IWF, a third request message indicating a request for a second N3IWF key, wherein the third request message comprises an identifier for the N3IWF, wherein the second N3IWF key is derived by a wireless communication network based on a second AKMA anchor key, wherein the second AKMA anchor key is derived by the wireless communication network after a first authentication process, wherein the first authentication process is performed during a first registration between a user equipment,UE, and the wireless communication network. The operations of 1102 may be performed in accordance with examples as described herein. In some implementations, aspects of the operations of 1102 may be performed by a NE as described with reference to Figure 8.

[0152] At 1104, the method 1100 may include sending, to the N3IWF, a third response message comprising an indication of the second N3IWF key. The operations of 1104 may be performed in accordance with examples as described herein. In some implementations, aspects of the operations of 1104 may be performed by a NE as described with reference to Figure 8.

[0153] There is provided a user equipment, UE, for wireless communication, comprising: at least one memory; and at least one processor coupled with the at least one memory and configured to cause the UE to: derive first authentication and key management for applications, AKMA, anchor key after a first authentication process, wherein the first authentication process is performed during a first registration between the UE and a wireless communication network via a first access network; and send, to a non-3GPP interworking function, N3IWF via a second access network, a first request message for initiating a second registration with the wireless communication network, the first request message comprising a first authentication payload, wherein the first authentication payload is generated based on a first N3IWF key, wherein the first N3IWF key is derived by the UE based on the first AKMA anchor key and an identifier for the N3IWF. Such a UE tends to reduce the complexity and duration of a registration process between the UE and the wireless communication network.

[0154] A successful registration process between the UE and the wireless communication network via the second access network may indicate that the UE is trusted. The first authentication payload may be for verifying the identity of the UE. The first request message may be an authentication request message.

[0155] The first registration may be between the UE and an Access and Mobility Management Function, AMF, the wireless communication network. The UE may register with the AMF. During registration, the UE may be authenticated by an Authentication Server Function, AUSF. The first authentication process may be between the UE and an AUSF. The first authentication process may be a primary authentication process betweenthe UE and the wireless communication network. The first access network may be a third generation partnership project, 3 GPP, access network. The first access network may be a next generation radio access network, NG RAN.

[0156] The wireless communication network may be based on 3rd Generation Partnership Project, 3GPP, standards. The wireless communication network may be a 5G network. The wireless communication network may comprise a 3 GPP Access Network. The wireless communication network may comprise an Access & Mobility Management Function, AMF. The wireless communication network may comprise an Authentication Server Function, AUSF. The wireless communication network may comprise an Authentication and Key Management for Applications, AKMA, Anchor Function, AAnF. The wireless communication network may comprise a non-3GPP interworking function.

[0157] The first AKMA anchor key may be for mutual authentication between the UE and an Application Function (AF).

[0158] The second registration may comprise performing an AKMA procedure between the UE and the N3IWF using the first AKMA anchor key. The AKMA procedure may enable the UE to register with the wireless communication network via the N3IWF. The first AKMA anchor key may be used for authentication between the UE and the N3IWF. The identifier for the N3IWF may be used for authentication between the UE and the N3IWF.

[0159] The second access network may be a non-3GPP access network. The non-3GPP access network may be an untrusted non-3GPP access network. The second access network may be a Wireless Fidelity, WiFi, access network. The N3IWF may be part of the second access network. The N3IWF may connect to the second access network. The N3IWF may translate signals from the non-3GPP access network into signals for the wireless communication network.

[0160] The first request message may be an IKE AUTH request message. The first authentication payload may be an AUTH-1 payload. The AUTH-1 payload may comprise an authentication method and authentication data. The authentication data may comprise afirst cryptographic hash computed using the first N3IWF key. The first request message may be a QUIC handshake packet.

[0161] The first N3IWF key may be a key used to authenticate and secure communication between the wireless communication network and the second network access network. The first N3IWF key may be an Application Function, AF, key when the identifier for the N3IWF is an AF identity. The first N3IWF key may be derived based on the KAF derivation function defined in TS 33.353 V18.3.0, clause A.4. The identifier for the N3IWF may be a Fully Qualified Domain Name (FQDN) for the N3IWF. The first N3IWF key may be derived using a key derivation function. The key derivation function may derive the first N3IWF key using the AKMA anchor key. The key derivation function may derive the first N3IWF key using the identifier for the N3IWF.

[0162] The UE may be configured to connect to the wireless communication network. The UE may be configured to connect to the first access network. The UE may be configured to connect to the second access network. The UE may be a remote unit. The UE may be a smartphone.

[0163] The at least one processor coupled with the at least one memory may be further configured to cause the UE to: complete a secure connection between the UE and the wireless communication network via the N3IWF. The at least one processor coupled with the at least one memory may be further configured to cause the UE to: send one or more registration messages to the wireless communication network via the N3IWF over the secure connection.

[0164] The at least one processor coupled with the at least one memory may be further configured to cause the UE to: receive, from the N3IWF via the second access network, a first response message comprising a second authentication payload, wherein the second authentication payload is generated based on a second N3IWF key.

[0165] The first N3IWF key may be a key generated in the UE. The second N3IWF key may be a key generated by a AAnF and transferred to N3IWF. The first response message may be an authentication response message. The first response message may be anIKE AUTH response message. The first response message may be a QUIC handshake packet.

[0166] The second authentication payload may be for verifying the identity of the N3IWF. The second authentication payload may be an AUTH-2. The second N3IWF key may be generated by the AAnF in the wireless communication network. The second N3IWF key may be a key used to authenticate and secure communication between the wireless communication network and the second access network. The second N3IWF key may be identical to the first N3IWF key. The second N3IWF key may be an Application Function, AF, key when the identifier for the N3IWF is an AF identity. The second N3IWF key may be derived based on the KAF derivation function defined in TS 33.353 V18.3.0, clause A.4. The second N3IWF key may be derived using a key derivation function. The key derivation function may derive the second N3IWF key using a second AKMA anchor key. The second AKMA anchor key may be derived by an Authentication Server Function, AUSF, in the wireless communication network. The second AKMA anchor key may be for mutual authentication between the AUSF and an Application Function (AF). The second AKMA anchor key may be identical to the first AKMA anchor key. The key derivation function may derive the second N3IWF key using the identifier for the N3IWF.

[0167] The second authentication payload may comprise a second cryptographic hash computed using the second N3IWF key. The at least one processor coupled with the at least one memory may be further configured to cause the UE to: validate the second authentication payload using the first N3IWF key. The at least one processor coupled with the at least one memory being configured to cause the UE to validate the second authentication payload using the first N3IWF key may comprise the at least one processor coupled with the at least one memory being further configured to cause the UE to: perform a function on the second cryptographic hash using the first N3IWF key.

[0168] The at least one processor coupled with the at least one memory may be further configured to cause the UE to: derive the first AKMA anchor key from a first authentication server function, AUSF, key. The first AUSF key may be derived by the user equipment, UE, during the first authentication procedure with an AUSF in the wireless communication network. A second AUSF key may be derived by the AUSF during the firstauthentication procedure with the UE. The first AUSF key may be derived from a secret key. The secret key may be stored in a Universal Subscriber Identity Module, USIM, in the UE. The second AUSF key may be derived from the secret key. The secret key may be stored in the AUSF.

[0169] The at least one processor coupled with the at least one memory may be further configured to cause the UE to: derive an identifier for the first AKMA anchor key from the first AUSF key. The identifier for the first AKMA anchor key may be an Authentication and Key Management for Applications, AKMA, anchor key identifier (A-KID). The identifier for the first AKMA anchor key may be used for authentication between the UE and the N3IWF. The identifier for the first AKMA anchor key may be for mutual authentication between the UE and an Application Function (AF). The first request message may comprise the identifier for the first AKMA anchor key.

[0170] The at least one processor coupled with the at least one memory may be further configured to cause the UE to: discover the N3IWF.

[0171] The at least one processor coupled with the at least one memory being configured to cause the UE to discover the N3IWF may comprise the at least one processor coupled with the at least one memory being further configured to cause the UE to: send a second request message, wherein the second request message comprises a request for an identifier of a non-3GPP interworking function that supports authentication and key management for applications, AKMA. The second request message may be a Domain Name System, DNS, request message. The second request message may be sent to the second access network.

[0172] The at least one processor coupled with the at least one memory may be further configured to cause the UE to: receive, in response to the second request message, the identifier for the N3IWF. The identifier for the N3IWF may be received from the second access network. The N3IWF may support authentication and key management for applications.

[0173] The at least one processor coupled with the at least one memory may be further configured to cause the UE to: establish an Internet Protocol Security, IPsec, SecurityAssociation, SA, between the UE and the N3IWF. The first authentication payload may comprise a first cryptographic hash computed using the first N3IWF key.

[0174] There is further provided a processor for wireless communication, comprising: at least one controller coupled with at least one memory and configured to cause the processor to: derive first authentication and key management for applications, AKMA, anchor key after a first authentication process, wherein the first authentication process is performed during a first registration between a user equipment, UE, and a wireless communication network via a first access network; and send, to a non-3GPP interworking function, N3IWF via a second access network, a first request message for initiating a second registration with the wireless communication network, the first request message comprising a first authentication payload, wherein the first authentication payload is generated based on a first N3IWF key, wherein the first N3IWF key is derived by the UE based on the first AKMA anchor key and an identifier for the N3IWF. Such a processor tends to reduce the complexity and duration of a registration process between the UE and the wireless communication network.

[0175] There is further provided a method performed by a user equipment, UE, the method comprising: deriving a first authentication and key management for applications, AKMA, anchor key after a first authentication process, wherein the first authentication process is performed during a first registration between the UE and a wireless communication network via a first access network; and sending, to a non-3GPP interworking function, N3IWF via a second access network, a first request message for initiating a second registration with the wireless communication network, the first request message comprising a first authentication payload, wherein the first authentication payload is generated based on a first N3IWF key, wherein the first N3IWF key is derived by the UE based on the first AKMA anchor key and an identifier for the N3IWF. Such a method tends to reduce the complexity and duration of a registration process between the UE and the wireless communication network.

[0176] The method may further comprise completing a secure connection between the UE and the wireless communication network via the N3IWF. The method may furthercomprise sending registration messages to the wireless communication network via the N3IWF over the secure connection.

[0177] The method may further comprise receiving, from the N3IWF via the second access network, a first response message comprising a second authentication payload, wherein the second authentication payload is generated based on a second N3IWF key. The first N3IWF key may be a key generated in the UE. The second N3IWF key may be a key generated in AAnF and transferred to N3IWF. The second authentication payload may comprise a second cryptographic hash computed using the second N3IWF key.

[0178] The method may further comprise validating the second authentication payload using the first N3IWF key. Validating the second authentication payload using the first N3IWF key may comprise performing a function on the second cryptographic hash using the first N3IWF key.

[0179] The method may further comprise deriving the first AKMA anchor key from a first authentication server function, AUSF, key. The method may further comprise deriving an identifier for the first AKMA anchor key from the first AUSF key. The first request message may comprise the identifier for the first AKMA anchor key.

[0180] The method may further comprise discovering the N3IWF. Discovering the N3IWF may comprise sending a second request message, wherein the second request message comprises a request for an identifier of a non-3GPP interworking function that supports authentication and key management for applications, AKMA. The method may further comprise receiving, in response to the second request message, the identifier for the N3IWF. The first authentication payload may comprise a first cryptographic hash computed using the first N3IWF key.

[0181] There is further provided a non-3GPP interworking function, N3IWF, for wireless communication, comprising: at least one memory; and at least one processor coupled with the at least one memory and configured to cause the N3IWF to: receive, from a user equipment, UE, via a second access network, a first request message for initiating a second registration with a wireless communication network, the first request message comprising a first authentication payload, wherein the first authentication payload isgenerated based on a first N3IWF key, wherein the first N3IWF key is derived by the UE based on a first authentication and key management for applications, AKMA, anchor key and an identifier for the N3IWF, wherein the first AKMA anchor key is derived by the UE after a first authentication process, wherein the first authentication process is performed during a first registration between the UE and a wireless communication network via a first access network. Such an N3IWF tends to reduce the complexity and duration of a registration process between the UE and the wireless communication network.

[0182] A successful registration process between the UE and the wireless communication network via the second access network may indicate that the UE is trusted.

[0183] The first N3IWF key may be derived by based on a first authentication and key management for applications, AKMA, anchor key and an identifier for the N3IWF. The first AKMA anchor key is derived after a first authentication process.

[0184] The at least one processor coupled with the at least one memory may be further configured to cause the N3IWF to: send, to the UE via the second access network, a first response message comprising a second authentication payload, wherein the second authentication payload is generated based on a second N3IWF key.

[0185] The first authentication payload may comprise a first cryptographic hash computed using the first N3IWF key. The second authentication payload may comprise a second cryptographic hash computed using the second N3IWF key. The second authentication payload may be generated based on the second N3IWF key and an identifier for the N3IWF.

[0186] The at least one processor coupled with the at least one memory may be further configured to cause the N3IWF to: send, to an Authentication and Key Management for Applications, AKMA, Anchor Function, AAnF, a third request message indicating a request for the second N3IWF key. The third request message may comprise the identifier for the N3IWF. The second N3IWF key may be derived by the wireless communication network based on a second AKMA anchor key. The second AKMA anchor key may be derived by the wireless communication network after a first authentication process. The first authentication process may be performed during a first registration between the UEand the wireless communication network. The third request message may further comprise the identifier for the second AKMA anchor key. The identifier for the second AKMA anchor key may be an Authentication and Key Management for Applications, AKMA, anchor key identifier (A-KID). The third request message may be aNaanf AKMA ApplicationKey Get Request (A-KID, N3IWF ID) message as defined in TS 33.353 V18.3.0.

[0187] The at least one processor coupled with the at least one memory may be further configured to cause the N3IWF to: receive, from the AAnF, a third response message comprising an indication of the second N3IWF key. The third response message may be a Naanf_AKMA_ApplicationKey_Get Response message as defined in TS 33.353 V18.3.0.

[0188] The at least one processor coupled with the at least one memory may be further configured to cause the N3IWF to: validate the first authentication payload using the second N3IWF key. The at least one processor coupled with the at least one memory being configured to cause the N3IWF to validate the first authentication payload using the second N3IWF key may comprise the at least one processor coupled with the at least one memory being further configured to cause the N3IWF to: perform a function on the first cryptographic hash using the second N3IWF key.

[0189] The at least one processor coupled with the at least one memory may be further configured to cause the N3IWF to: generate the second authentication payload using the second N3IWF key. The at least one processor coupled with the at least one memory may be further configured to cause the N3IWF to: generate the second cryptographic using the second N3IWF key.

[0190] The at least one processor coupled with the at least one memory may be further configured to cause the N3IWF to: establish an Internet Protocol Security, IPsec, Security Association, SA, between the UE and the N3IWF.

[0191] The at least one processor coupled with the at least one memory may be further configured to cause the N3IWF to: send, to an AMF, an indication that the registration process between the UE and the wireless communication network via the second access network is successful.

[0192] There is further provided a processor for wireless communication, comprising: at least one controller coupled with at least one memory and configured to cause the processor to: receive, from a user equipment, UE, via a second access network, a first request message for initiating a second registration with a wireless communication network, the first request message comprising a first authentication payload, wherein the first authentication payload is generated based on a first N3IWF key, wherein the first N3IWF key is derived by the UE based on a first authentication and key management for applications, AKMA, anchor key and an identifier for the N3IWF, wherein the first AKMA anchor key is derived by the UE after a first authentication process, wherein the first authentication process is performed during a first registration between the UE and a wireless communication network via a first access network. Such a processor tends to reduce the complexity and duration of a registration process between the UE and the wireless communication network.

[0193] There is further provided a method performed by a non-3GPP interworking function, N3IWF, the method comprising: receiving, from a user equipment, UE, via a second access network, a first request message for initiating a second registration with a wireless communication network, the first request message comprising a first authentication payload, wherein the first authentication payload is generated based on a first N3IWF key, wherein the first N3IWF key is derived by the UE based on a first authentication and key management for applications, AKMA, anchor key and an identifier for the N3IWF, wherein the first AKMA anchor key is derived by the UE after a first authentication process, wherein the first authentication process is performed during a first registration between the UE and a wireless communication network via a first access network. Such a method tends to reduce the complexity and duration of a registration process between the UE and the wireless communication network.

[0194] There is further provided an Authentication and Key Management for Applications, AKMA, Anchor Function, AAnF, for wireless communication, comprising: at least one memory; and at least one processor coupled with the at least one memory and configured to cause the AAnF to: receive, from a non-3GPP interworking function, N3IWF, a third request message indicating a request for a second N3IWF key, wherein thethird request message comprises an identifier for the N3IWF, wherein the second N3IWF key is derived by a wireless communication network based on a second AKMA anchor key, wherein the second AKMA anchor key is derived by the wireless communication network after a first authentication process, wherein the first authentication process is performed during a first registration between a user equipment, UE, and the wireless communication network; and send, to the N3IWF, a third response message comprising an indication of the second N3IWF key. Such an AAnF tends to reduce the complexity and duration of a registration process between the UE and the wireless communication network.

[0195] The second AKMA anchor key may be used to authenticate the UE when connecting to the wireless communication network. The second AKMA anchor key may be identical to the first AKMA anchor key.

[0196] The third request message may comprise an identifier for the second AKMA anchor key. The at least one processor coupled with the at least one memory may be further configured to cause the AAnF to: retrieve the second AKMA anchor key from a database based on the identifier for the second AKMA anchor key.

[0197] The at least one processor coupled with the at least one memory may be further configured to cause the AAnF to: derive the second N3IWF key from the identifier for the N3IWF. The at least one processor coupled with the at least one memory may be further configured to cause the AAnF to: derive the second N3IWF key from the second AKMA anchor key. The at least one processor coupled with the at least one memory may be further configured to cause the AAnF to: derive the second N3IWF key from the identifier for the N3IWF and the second AKMA anchor key.

[0198] There is further provided a processor for wireless communication, comprising: at least one controller coupled with at least one memory and configured to cause the processor to: receive, from a non-3GPP interworking function, N3IWF, a third request message indicating a request for a second N3IWF key, wherein the third request message comprises an identifier for the N3IWF, wherein the second N3IWF key is derived by a wireless communication network based on a second AKMA anchor key, wherein the second AKMA anchor key is derived by the wireless communication network after a first authentication process, wherein the first authentication process is performed during a firstregistration between a user equipment, UE, and the wireless communication network; and send, to the N3IWF, a third response message comprising an indication of the second N3IWF key. Such a processor tends to reduce the complexity and duration of a registration process between the UE and the wireless communication network.

[0199] There is provided a method performed by an Authentication and Key Management for Applications, AKMA, Anchor Function, AAnF, the method comprising: receiving, from a non-3GPP interworking function, N3IWF, a third request message indicating a request for a second N3IWF key, wherein the third request message comprises an identifier for the N3IWF, wherein the second N3IWF key is derived by a wireless communication network based on a second AKMA anchor key, wherein the second AKMA anchor key is derived by the wireless communication network after a first authentication process, wherein the first authentication process is performed during a first registration between a user equipment, UE, and the wireless communication network; and sending, to the N3IWF, a third response message comprising an indication of the second N3IWF key. Such a method tends to reduce the complexity and duration of a registration process between the UE and the wireless communication network.

[0200] There is provided a "5G registration via untrusted non-3GPP access" procedure using AKMA. This tends to provide an enhanced authentication mechanism that circumvents the need of Extensible Authentication Protocol (EAP) sessions. There is provided a process to integrate AKMA to perform mutual authentication directly between the UE and the N3IWF, which tends to streamline the registration process.

[0201] Upon completion of a primary authentication, both the UE and the Authentication Server Function (AUSF) independently generate an AKMA Anchor Key (KAKMA) and AKMA Key Identifier (A-KID). The KAKMA and A-KID may be used to support secure and expedited registration without the need for EAP sessions.

[0202] Contrary to the conventional method where an EAP session starts and spans multiple steps, examples described herein directly use AKMA for authentication. The UE may send an IKE AUTH request including an authentication payload (AUTH-1), which may contain a cryptographic hash computed using the N3IWF key derived from KAKMA.The N3IWF may verify this and respond with its own authentication payload (AUTH-2), confirming mutual authentication.

[0203] Examples described herein tend to result in rapid establishment of IPsec SA. This rapid establishment of an IPsec SA following mutual authentication with AKMA tends to allow for quick transition to secure NAS signaling. This also tends to reduce traditional delays associated with EAP session establishment and completion.

[0204] Examples described herein tend to result in more efficient NAS Signaling. Postauthentication, NAS signaling is efficiently handled over the established signaling IPsec SA, which tends to significantly speed up the registration process.

[0205] Examples described here tend to simplify the registration process. Examples described herein tend to enhance the security and efficiency of accessing 5G networks via untrusted non-3GPP access, making it a significant advancement over existing procedures. Examples described herein may be applied after a primary authentication procedure has been executed and keying material has been generated in the UE and in the network (such as in an AUSF).

[0206] There is further provided an apparatus storing code for a Non-3GPP Interworking Function (N3IWF), the apparatus comprising: at least one memory storing the code; and at least one processor coupled with the at least one memory and configured to execute the code to cause the N3IWF to: Establish an IKE Security Association (IKE SA) with a UE connection over an untrusted non-3GPP access network (see step 472 in Figure 4); Receive an IKE AUTH request from the UE, which includes a first AUTH payload comprising a cryptographic hash computed using a first N3IWF key in the UE, wherein the N3IWF key is derived from an AKMA anchor key and from an identity of N3IWF; Select an AKMA anchor function (AAnF) in response to receiving the IKE AUTH request including the first AUTH payload; Retrieve a second N3IWF key from the AAnF; Validate the first AUTH payload using the second N3IWF key; Transmit an IKE AUTH response to the UE, the response containing a second AUTH payload generated using the second N3IWF key; Facilitate the establishment of a signaling IPsec Security Association (SA) used to securely transmit NAS signaling messages between the UE to an Access and Mobility Function (AMF) in the 5G network.

[0207] It should be noted that the method described herein describes a possible implementation, and that the operations and the steps may be rearranged or otherwise modified and that other implementations are possible.

[0208] The description herein is provided to enable a person having ordinary skill in the art to make or use the disclosure. Various modifications to the disclosure will be apparent to a person having ordinary skill in the art, and the generic principles defined herein may be applied to other variations without departing from the scope of the disclosure. Thus, the disclosure is not limited to the examples and designs described herein but is to be accorded the broadest scope consistent with the principles and novel features disclosed herein.

Claims

CLAIMSWhat is claimed is:

1. A user equipment, UE, for wireless communication, comprising: at least one memory; and at least one processor coupled with the at least one memory and configured to cause the UE to: derive first authentication and key management for applications, AKMA, anchor key after a first authentication process, wherein the first authentication process is performed during a first registration between the UE and a wireless communication network via a first access network; and send, to a non-3GPP interworking function, N3IWF via a second access network, a first request message for initiating a second registration with the wireless communication network, the first request message comprising a first authentication payload, wherein the first authentication payload is generated based on a first N3IWF key, wherein the first N3IWF key is derived by the UE based on the first AKMA anchor key and an identifier for the N3IWF.

2. The UE of claim 1, wherein the at least one processor coupled with the at least one memory is further configured to cause the UE to: receive, from the N3IWF via the second access network, a first response message comprising a second authentication payload, wherein the second authentication payload is generated based on a second N3IWF key.

3. The UE of claim 2, wherein the second authentication payload comprises a second cryptographic hash computed using the second N3IWF key.

4. The UE of any one of claims 2 to 3, wherein the at least one processor coupled with the at least one memory is further configured to cause the UE to: validate the second authentication payload using the first N3IWF key.

5. The UE of any one of claims 1 to 4, wherein the at least one processor coupled with the at least one memory is further configured to cause the UE to: derive the first AKMA anchor key from a first authentication server function, AUSF, key.

6. The UE of claim 5, wherein the at least one processor coupled with the at least one memory is further configured to cause the UE to: derive an identifier for the first AKMA anchor key from the first AUSF key.

7. The UE of claim 6, wherein the first request message comprises the identifier for the first AKMA anchor key.

8. The UE of any one of claims 1 to 7, wherein the at least one processor coupled with the at least one memory is further configured to cause the UE to: discover the N3IWF.

9. The UE of claim 8, wherein the at least one processor coupled with the at least one memory being configured to cause the UE to discover the N3IWF comprises the at least one processor coupled with the at least one memory being further configured to cause the UE to: send a second request message, wherein the second request message comprises a request for an identifier of a non-3GPP interworking function that supports authentication and key management for applications, AKMA.

10. The UE of claim 9, wherein the at least one processor coupled with the at least one memory is further configured to cause the UE to: receive, in response to the second request message, the identifier for the N3IWF.

11. The UE of any one of claims 1 to 10, wherein the first authentication payload comprises a first cryptographic hash computed using the first N3IWF key.

12. A processor for wireless communication, comprising: at least one controller coupled with at least one memory and configured to cause the processor to: derive first authentication and key management for applications, AKMA, anchor key after a first authentication process, wherein the first authentication process is performed during a first registration between a user equipment, UE, and a wireless communication network via a first access network; and send, to a non-3GPP interworking function, N3IWF via a second access network, a first request message for initiating a second registration with the wireless communication network, the first request message comprising a first authentication payload, wherein the first authentication payload is generated based on a first N3IWF key, wherein the first N3IWF key is derived by the UE based on the first AKMA anchor key and an identifier for the N3IWF.

13. A method performed by a user equipment, UE, the method comprising: deriving a first authentication and key management for applications, AKMA, anchor key after a first authentication process, wherein the first authentication process is performed during a first registration between the UE and a wireless communication network via a first access network; and sending, to a non-3GPP interworking function, N3IWF via a second access network, a first request message for initiating a second registration with the wireless communication network, the first request message comprising a first authentication payload, wherein the first authentication payload is generated based on a first N3IWF key, wherein the first N3IWF key is derived by the UE based on the first AKMA anchor key and an identifier for the N3IWF.

14. A non-3GPP interworking function, N3IWF, for wireless communication, comprising: at least one memory; and at least one processor coupled with the at least one memory and configured to cause the N3IWF to:receive, from a user equipment, UE, via a second access network, a first request message for initiating a second registration with a wireless communication network, the first request message comprising a first authentication payload, wherein the first authentication payload is generated based on a first N3IWF key, wherein the first N3IWF key is derived by the UE based on a first authentication and key management for applications, AKMA, anchor key and an identifier for the N3IWF, wherein the first AKMA anchor key is derived by the UE after a first authentication process, wherein the first authentication process is performed during a first registration between the UE and a wireless communication network via a first access network.

15. The N3IWF of claim 14, wherein the at least one processor coupled with the at least one memory is further configured to cause the N3IWF to: send, to the UE via the second access network, a first response message comprising a second authentication payload, wherein the second authentication payload is generated based on a second N3IWF key.

Images